770e8e728b981a800b60685d7598d7852fbad7afa979b5cdb4b461898a221bc2 | Triage

Analysis

max time kernel
134s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
23/05/2024, 13:03

Sharing

Report Analysis Logs

General

Target

AppCapture.dll
Size

137KB
MD5

37bdd20082372c4a99774f84ccbdaca2
SHA1

b76bfa7825afd0f641b06006f70c85736adb068c
SHA256

770e8e728b981a800b60685d7598d7852fbad7afa979b5cdb4b461898a221bc2
SHA512

d04f9c0b519f6a70e25b5c54ca5f640fcc1a5bbee1114fc6ba3b5ffd20aff1c05fd3cab14d930f361ac979b16d6bff01c1e567dfe224b5039ac81299f2ab4a7e
SSDEEP

3072:Tz8QYwimPNGeGHc4nIl/TSng2J2+3Zt1YJAUt3MLxj/7cWDXeWB:PYwxPR4nAM2s2qUZYxL7c7

Score

1^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 1020	1524	rundll32.exe	85
PID 1524 wrote to memory of 1020	1524	rundll32.exe	85
PID 1524 wrote to memory of 1020	1524	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppCapture.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\AppCapture.dll,#1
  2⤵
  PID:1020

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads